Apache Airflow's Variable response masker is designed to redact sensitive information in JSON variables by masking keys with secret-suffixed names. However, the masker has a recursion depth limit, and if sensitive keys are nested deeper than this limit, the masker returns the original unredacted value. This allows authenticated UI/API users with Variable read permissions to retrieve plaintext secrets stored in deeply nested JSON variables. The vulnerability is a continuation of a previous issue fixed for shallow nesting but not for deeper nesting. The recommended fix is to upgrade Apache Airflow to version 3.2.2 or later, which addresses this deep-nesting masking bypass.

An authenticated user with Variable read permission can access sensitive secret values in plaintext if those secrets are stored in deeply nested JSON variables exceeding the masker's recursion depth. This exposure could lead to unauthorized disclosure of credentials or tokens stored in Airflow variables. The impact is limited to users with Variable read permissions and deployments that store secrets in deeply nested JSON structures.

Users should upgrade Apache Airflow to version 3.2.2 or later to address this vulnerability. This version raises the recursion depth limit for the Variable response masker, preventing the bypass of secret redaction in deeply nested JSON variables. No other mitigation or temporary fix is indicated. Patch status is not explicitly confirmed in the advisory, but the upgrade recommendation implies an official fix is available in 3.2.2+.